fix: validate QR and action metadata edges

auth.go

@@ -262,6 +262,9 @@ func (writer *recordingWriter) Write(payload []byte) (int, error) {
 		return 0, writer.err
 	}
 	written, err := writer.w.Write(payload)
+	if err == nil && written < len(payload) {
+		err = io.ErrShortWrite
+	}
 	if err != nil {
 		writer.err = err
 	}
@@ -354,17 +357,21 @@ func (client *Client) getLocation(ctx context.Context) (url.Values, bool, error)
 		if readErr != nil {
 			return nil, false, fmt.Errorf("read token refresh response: %w", readErr)
 		}
-		if response.StatusCode == http.StatusOK && string(body) == "ok" {
-			candidate := client.AuthData()
-			serviceTokenReceived := updateAuthDataFromCookies(&candidate, httpClient, response.Request.URL)
-			candidate.Ssecurity = data.Ssecurity
-			if !serviceTokenReceived || !candidate.complete() {
-				return nil, false, fmt.Errorf("%w: %w", ErrReauthenticationRequired, &LoginError{Code: -1, Message: "刷新Token响应认证信息不完整"})
-			}
-			candidate.ExpireTime = time.Now().Add(30 * 24 * time.Hour).UnixMilli()
-			client.setAuthData(candidate)
-			return nil, true, nil
+		if response.StatusCode != http.StatusOK {
+			return nil, false, &LoginError{Code: response.StatusCode, Message: string(body)}
 		}
+		if string(body) != "ok" {
+			return nil, false, &LoginError{Code: -1, Message: string(body)}
+		}
+		candidate := client.AuthData()
+		serviceTokenReceived := updateAuthDataFromCookies(&candidate, httpClient, response.Request.URL)
+		candidate.Ssecurity = data.Ssecurity
+		if !serviceTokenReceived || !candidate.complete() {
+			return nil, false, fmt.Errorf("%w: %w", ErrReauthenticationRequired, &LoginError{Code: -1, Message: "刷新Token响应认证信息不完整"})
+		}
+		candidate.ExpireTime = time.Now().Add(30 * 24 * time.Hour).UnixMilli()
+		client.setAuthData(candidate)
+		return nil, true, nil
 	}
 	locationURL, err := url.Parse(data.Location)
 	if err != nil {